Which of the Following Is NOT Among the Common Guidelines

Which of the following is NOT among the common guidelines that should be reflected in the rule base to implement an organization's security policy?

A) only authenticated traffic can access the internal network
B) employees can use instant-messaging only with external network users
C) the public can access the company Web servers
D) employees can have restricted Internet access